RISK: ISO 31000 (2009) defines risk as the effect of uncertainty on objectives. In many industry, ISO 31000 has been adopted as the standard for enterprise risk management in many industries. The approach to ERM consists of both qualitative and quantitative.  Whichever approach to follow, the following factors are the general themes:

1. Internal environment of the organization (context)

2. Objective

3. Event identification

4. Risk assessment

5. Risk response

6. Control activity

7. Information communication

8. Monitory

In accounting or finance, for instance, the risk management approach may focus on: cash flow risk, earnings at risk, earnings distribution or EPS distribution. The quantitative modeling adopted by the analyst depends on the objective. ISO 31000 model is more intended for practical application.

REFERENCES: Attached are some articles that may be helpful in looking at various approaches to ERM.

Thank you very much, Paul.

Topics nad maybe ahp

Using ISO 31000 in ERM is frequently done, and it fails almost as frequently in many business environments.

COSO is the standard for ERM, and even COSO is only suited to manage the more financial risks of an organization. I.e. currency dependencies, natural resource dependencies, legal risks and such.

ISO 31000 for risk analysis in an organization fails for the simple reason, that it is not designed for bottom up analysis. It is designed to avoid risks in executing decisions. For some reasons people thinks that aggregating the top risks identified during risk work in executing the project, will inform management about what risks they exposed to. This is completely wrong, and very far from real life.

The only contribution ISO 31.000 makes to ERM is reducing the risks of the organization. Not to say that is unimportant. But it will not tell you anything comprehensively about what risks are still in the organization. It will not tell you what risks that have been accepted.

The reason is RM (ISO 31000) is devoid of the structure that normally applies for investments and corporate goals (goal, schedule and budget). In RM any parameter, that can influence your ability to reach your goal can be stated as a risk.

I.e. I can say that there is a risk of a bad collaboration between team a and team b.

I would like to see anyone make a good ERM analysis of that risk. How does that risk threaten your capital and your future earnings?

Recently I have developed and implemented a risk management system, called Structural Risk Management (SRM). This risk management process deviated significantly from COSO and ISO 31000, in being true to the financial structures of a company. Through this process it has been possible to get a better insight into the risks of i.e. a large technical portfolio ( a USD 2,5 bn 7 project construction portfolio and the project organization of small to midsize Oil and Gas exploration, development and production company).

The process has not yet been published, but the point is that I strongly urge you to consider the actual ERM value of any ISO 31000 based process. In my experience the input is worthless in 95 % of the situations where it is used, and where it is based on the risk analysis of an internal group.

The success is higher in organization that has a 3rd party relationship to the risk, such as insurance companies, because these companies relies much more on historic data/benchmark data to identify the risks, than they rely on an actual ISO 31000 based process.

Very interesting dear Jesper.Thanks.

Dear Simona,

You raise some interesting question around ‘quantification’ implying existing ‘measurement models’, and I agree with Jesper regarding ‘COSO (2004) of the ERM Integrated framework’ and ‘ISO 31 000 standards’ as two of the most widely used standards; and Paul's description of the components or factors constituting the general themes. COSO is the abbreviation for ‘Commission of Sponsoring Organizations of the Three-way Commission. From the ‘Construction Industry’ perspective, the two ‘standards’ are also among the widely used.

However, there are also other ‘frameworks’ that can be used to ‘measure’ (as implied in the question) ERM such as ‘Enterprise Risk Scorecard’. Furthermore, different industries have their own preferences. For example, within the ‘Insurance’ sector, some application (usage) of risk capital and ‘ERM’ can be found in the following article:

Diers, D. (2012), “A multi-year risk capital concept for internal models and enterprise risk management”, The Journal of Risk Finance, Vol. 13, Iss: 5, pp. 424-437.

Though you have specified a ‘time frame’ in terms of ERM (i.e. recently), the following article by Sutton (2006) is also a must read though literature based, it does touch on some of the key issues that you have posed including raising the awareness of ERM as well as the framework of ‘risks’ that should be included and assessment (or measurement) issues.

Sutton, S.G. (2006), “Extended-enterprise systems’ impact on “enterprise risk management”, Journal of Enterprise Information Management, Vol. 19, Iss. 1, pp. 97-114.

Finally, the example related to the ‘Enterprise Risk Scorecard’ and issues associated with its concept can be found in Calandro and Lane (2006) article cited as follows: Calandro, J. and Lane, S. (2006), “An Introduction to the Enterprise Risk Scorecard”, Measuring Business Excellence, Vol. 10, Iss 3, pp. 31-40.

All the best with your research,

Nicholas

Dear Simona Mihai Yiannaki 

Greetings,

Please find the attached file related for your question may be helpful for you ,

Best Regards,

How about the PM2 Risk Scorecard model?

This tool is considered as part of a large process that combines both programs and fresh initiatives inside the org. This is mainly used to introduce new initiatives to help fix the underlying problems inside the organization.

There are several enterprise risk management (ERM) measurement models that are commonly used by organizations to assess and manage risks. Some of the most widely used ERM measurement models include:

These are just a few examples of the ERM measurement models that are commonly used by organizations to manage risks. The choice of a specific model may depend on the size and complexity of the organization, as well as its specific risk management needs and objectives.